CVE-2016-1939

Published on: 01/31/2016 12:00:00 AM UTC

Last Modified on: 03/23/2021 11:27:05 PM UTC

CVE-2016-1939

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Certain versions of Firefox from Mozilla contain the following vulnerability:

Mozilla Firefox before 44.0 stores cookies with names containing vertical tab characters, which allows remote attackers to obtain sensitive information by reading HTTP Cookie headers. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-7208.

CVE-2016-1939 has been assigned by [email protected] to track the vulnerability - currently rated as MEDIUM severity.

CVSS3 Score: 5.3 - MEDIUM

Attack Vector ^ⓘ	Attack Complexity	Privileges Required	User Interaction
NETWORK	LOW	NONE	NONE
Scope	Confidentiality Impact	Integrity Impact	Availability Impact
UNCHANGED	LOW	NONE	NONE

CVSS2 Score: 5 - MEDIUM

Access Vector^ⓘ	Access Complexity	Authentication
NETWORK	LOW	NONE
Confidentiality Impact	Integrity Impact	Availability Impact
PARTIAL	NONE	NONE

CVE References

Description	Tags ^ⓘ	Link
[security-announce] openSUSE-SU-2016:0306-1: important: Security update	lists.opensuse.org text/html	SUSE openSUSE-SU-2016:0306
1233784 - (CVE-2016-1939) firefox allows characters in cookie names that it shouldn't	bugzilla.mozilla.org text/html	CONFIRM bugzilla.mozilla.org/show_bug.cgi?id=1233784
USN-2880-2: Firefox regression \| Ubuntu	www.ubuntu.com text/html	UBUNTU USN-2880-2
Mozilla Products: Multiple vulnerabilities (GLSA 201605-06) — Gentoo security	security.gentoo.org text/html	GENTOO GLSA-201605-06
[security-announce] openSUSE-SU-2016:0309-1: important: Security update	lists.opensuse.org text/html	SUSE openSUSE-SU-2016:0309
Mozilla Firefox Multiple Flaws Let Remote Users Execute Arbitrary Code, Spoof the Address Bar, Bypass Security Restrictions, and Deny Service - SecurityTracker	www.securitytracker.com text/html	SECTRACK 1034825
Firefox allows for control characters to be set in cookie names — Mozilla	Vendor Advisory www.mozilla.org text/html	CONFIRM www.mozilla.org/security/announce/2016/mfsa2016-04.html
USN-2880-1: Firefox vulnerabilities \| Ubuntu	www.ubuntu.com text/html	UBUNTU USN-2880-1

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].

There are currently no QIDs associated with this CVE

Known Affected Configurations (CPE V2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Mozilla	Firefox	All	All	All	All
Operating System	Opensuse	Leap	42.1	All	All	All
Operating System	Opensuse	Leap	42.1	All	All	All
Operating System	Opensuse	Opensuse	13.1	All	All	All
Operating System	Opensuse	Opensuse	13.2	All	All	All
Operating System	Opensuse	Opensuse	13.1	All	All	All
Operating System	Opensuse	Opensuse	13.2	All	All	All

cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*:
cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*:
cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*:
cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*:
cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*:
cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*:
cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*:

No vendor comments have been submitted for this CVE